1. Technical Field
The present invention relates generally to secure electronic communication and more particularly to encryption and decryption of e-mail and other messages, files or other information.
2. Background Art
A key server may be used for managing and distributing symmetric encryption keys, that is, keys for an encryption system in which the encryption key and the decryption key for a particular message are the same. For example, in a secure e-mail system, a sender of an e-mail may request that the key server create and store a message key, that is, an encryption/decryption key for a message that is unique to that particular message or unique for a particular series of messages. The sender then encrypts the e-mail with the message key and sends it to the recipients. A given recipient then requests the message key from the key server, which determines the authenticity of the recipient. If the recipient is authentic and is also authorized to receive the message key (as specified by the original sender), the key server delivers the message key to the recipient, which uses the message key to decrypt the e-mail.
Distributing symmetric keys via a key server has many positive attributes. For example, a sender (or any authorized party) can determine when a recipient has requested and received the message key. This “key advisement” can form the basis of an audit system. Also, a sender (or any authorized party) can control access to the message key, including specifying not-before and not-after delivery times for a key. In this way, the message key can be made available only during a certain time window, or access can be terminated if conditions warrant denying any further access to the message.
Most present key server schemes make off-line decryption impossible because they require that the recipients be on line to communicate with the key server. There are some exceptions to this, however, and these off-line decryption systems generally use key enveloping via one of the following schemes. First, a sender can encrypt a message with a message key that is chosen at random. The message key is then encrypted (i.e., enveloped) with another key that is derived from a password known to the sender and all of the recipients. Second, as above, except that the message key is encrypted with a public key of the recipient. In either case, there is typically one envelope per recipient, particularly in the second scheme where each recipient's public key is different.
The first scheme above is weak. Enveloping a message key with another key that is derived from a password is susceptible to off-line dictionary attacks on the password. Given that most passwords need to be memorized by human users, and given that passwords must consist of printable characters, the effective length of a key derived from a password is anywhere from 1.5 to 5 bits per character. Thus, the effective length of a key derived from a twelve character password (which has 50% more characters than a typical password of eight characters) is anywhere from 18 to 60 bits. By today's standards, such a key is very weak and is subject to brute force attacks. In summary, a key derived from a password is subject to both off-line dictionary attacks as well as brute force attacks.
The second scheme above is very strong. However, enveloping a message key with the recipient's public key imposes burdensome requirements. For example, all intended recipients must already have a public key, and those must be available to the sender at the time of enveloping. In cases where the sender and recipients are new to each other, simply ascertaining public keys can be an obstacle. Setting up, by obtaining public and private keys and such, can also be daunting when a recipient is new to the scheme. Not surprisingly, many potential recipients opt out if any other options exist, even less secure ones, and many resist adoption until they expect to receive substantial numbers of messages secured in this manner. Furthermore, the private key of each recipient must be available at the place where that recipient desires to read the message. For instance, if a recipient stores his private key at a computer at work, he would not be able to decrypt the message at a home computer that does not also have a copy of the recipient's private key.
In summary, a password-based scheme is easy to use but offers weak security. A public key scheme offers strong security but is very difficult to deploy and use. Because of the reasons mentioned above, the current state-of-the-art off-line decryption systems do not simultaneously satisfy both security and ease-of-use requirements.